- Freeradius-Users - lists.freeradius.org

"Module ... became unblocked" after FR30 upgrade
by Jakob Hirsch 22 Jun '16

22 Jun '16

Hi, I'm getting lots of this since upgrading from 2.2.9 to 3.0.11: > Tue Jun 21 15:21:11 2016 : WARNING: (16279306) WARNING: Module rlm_detail became unblocked for request 16279306 > Tue Jun 21 15:21:11 2016 : WARNING: (16279309) WARNING: Module rlm_detail became unblocked for request 16279309 > Tue Jun 21 15:21:12 2016 : WARNING: (16279322) WARNING: Module rlm_preprocess became unblocked for request 16279322 > Tue Jun 21 15:21:13 2016 : WARNING: (16279341) WARNING: Module rlm_preprocess became unblocked for request 16279341 > Tue Jun 21 15:21:14 2016 : WARNING: (16279362) WARNING: Module rlm_detail became unblocked for request 16279362 > Tue Jun 21 15:21:20 2016 : WARNING: (16279468) WARNING: Module rlm_preprocess became unblocked for request 16279468 > Tue Jun 21 15:21:23 2016 : WARNING: (16279506) WARNING: Module rlm_preprocess became unblocked for request 16279506 > Tue Jun 21 15:23:38 2016 : WARNING: (16281993) WARNING: Module rlm_preprocess became unblocked for request 16281993 The only reference I found was for rlm_sql, where the OP was told that his SQL server is too slow, which is comprehensible. I don't see how rlm_detail or rlm_preprocess could be too slow, though, especially since there were merely 10 requests/s at this time.

3 3

force/require @domain/part
by lejeczek 22 Jun '16

22 Jun '16

hi users, I'm hoping this is possible, having pretty vanilla mschap & pap(ntlm) to tweak radius so it - for eap & pap (basically AD) - would fail if there is no @domain part in the request. Like when AD domain is @private.dom.my / PRIVATE and radius will absolutely need this. At the moment having configs constructed of bits from wikis/howtos, both: "me(a)private.dom.my" and "me" get authenticated. how to tweak? many thanks, L

4 5

amazing
by bunkertor＠tiscali.it 22 Jun '16

22 Jun '16

Hello, It is amazing what one can invent! You're gonna love it, I swear! Read more here <http://paltihywo.newyorktheater101.com/aecoqvgu> See you soon, bunkertor(a)tiscali.it

1 0

rotating detail files
by Jakob Hirsch 20 Jun '16

20 Jun '16

Hi, we want to dump all our requests into files, using the detail module. The files should be rotated (and archived) with the standard logrotate tool, which would need the freeradius daemon to to close and reopen the file (automatically or triggered, e.g. by SIGHUP, like the radius.log). But I found now way to tell the daemon (or the detail module) to do that. As I read from the code, this will only happen when the file is unlinked or nothing was written for 30 seconds. gzip will unlink the file afterwards, but it will complain about the changed file size during compression and there is chance of data loss (as something may be written just before the file is deleted). I know I can tell the detail module to separate the files by hour/day/whatever, but that would require significant changes in the subsequent processing, which I want to avoid (at least for now). Is there something I have missed? Or do I have to live with that (or patch the module)? TIA and regards Jakob

3 14

Authenticate to an external database
by Mauricio 20 Jun '16

20 Jun '16

Hi If someone can help me I'll be very greatful. I have a router with coova-chilli and openwrt, a freeradius virtual server and i have a server with the users database. I need authenticate the users, im trying with the rlm_rest and eap_tls, im in the correct way ? My doubt is because freeradius server not know the users credentials. These ones are stored in an existing database in an external server. Every user need to install a CA ? Thank you.

2 4

Checking Active Directory group membership with winbind
by Matthew Newton 20 Jun '16

20 Jun '16

Hi, There is now code in the rlm_winbind module in v3.1.x that permits checking AD group membership in a similar way that you can currently do with LDAP. So if you don't want to configure LDAP, but do have a need to check AD groups, this might be useful. I haven't done any benchmark tests, so have no idea whether it is any faster than using LDAP or not. For the first group request I suspect it may be slower due to the winbind gid remapping. For subsequent requests, which winbind still has the user's groups cached (a few minutes at least it seems) then group searches are very fast. Usage is similar to rlm_ldap. Enable the winbind module in mods-enabled, then you can: if (Winbind-Group == "my-user-group") { ... } for an instance of rlm_winbind e.g. winbind mywb { ... } you can use: if (mywb-Winbind-Group == "my-user-group") { ... } Running with -Xx gives more debug information including a list of all the groups being checked for the user (until a match is found). In addition, rlm_winbind will now try and find the current windows domain directly from winbind, so there should be no need to configure it with winbind_domain (this is not the case for the same option in rlm_mschap, yet...). Testing and feedback welcome. Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

3 3

Configuring auth+acct server in proxy.conf
by Anuruddha Premalal 20 Jun '16

20 Jun '16

Hi All, My proxy configuration file have the following, Requirement is to proxy both acct and auth request while accounting request being send to the local server as well as the proxy server (duplicate accounting) home_server tokyo_company.com{ type = auth+acct ipaddr = 154.24.191.34 port = 1812 secret = abcd response_window = 5 zombie_period = 5 } home_server us_company.com{ type = auth+acct ipaddr = 154.24.191.33 port = 1812 secret = 5622bfvMHTqf } home_server_pool pool_company.com { type = fail-over home_server = tokyo_company.com home_server = us_company.com } realm company.com{ nostrip pool = pool_company.com } However with this configuration it doesn't proxy the accounting to the 3rd party AAA instead it's going to the local server. Also with the home_server type=auth+acct how can we configure the accounting host and port information?. I wasn't able to find a useful resource online, appreciate the community help. Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>Sri Lanka.*

2 2

EAP-Tls with MySQL
by Nicolas Roussi 18 Jun '16

18 Jun '16

Hello, I have FR 2.1.12 setup with MySQL and EAP TLS. I set up my AP with WPA2 Enterprise and everything is working perfectly fine IF the user password in the database is saved as clear text. So if I have Cleartext-Password := secret It works. But if I have MD5-Password := <hashed secret> It does not. Is there a way to have it work with the MD5-Password? Thanks

3 5

Any way for ntlm_auth + winbind to not use ms-chap?
by Mike Ely 17 Jun '16

17 Jun '16

I'd like to use some other auth mechanism to pass the user/pass combination to the radius server and have it test there without having to go through the MS-CHAP challenge-response rigmorale. Main reason being getting Perl on the NAS side to manage all the MS-CHAP stuff appears to be a new problem to solve, somehow. How can this be done, and why shouldn't it be? Thanks, Mike

4 10

ntlm remotely ? - too much to...
by lejeczek 17 Jun '16

17 Jun '16

... ask of a radius server? To authenticate with a non-local, a remote ntlm/winbind ? Too much? many thanks, L

4 5